Skip to main content

Hello All,

We have encountered an error while we trying to parse. Please find the below error.

generic::unknown: pipeline.ParseLogEntry failed: LOG_PARSING_CBN_ERROR: "generic::invalid_argument: failed to convert raw output to events: failed to convert raw message 0: field \\"idm\\": index 0: recursive rawDataToProto failed: field \\"entity\\": index 0: recursive rawDataToProto failed: field \\"entity\\": index 0: recursive rawDataToProto failed: field \\"asset\\": index 0: recursive rawDataToProto failed: field \\"ip\\": failed to make strategy: received non-slice or non-array raw output for repeated field"

Could anyone please let me know how to rectify this?

Typically this error indicates you're trying to put an IP in to UDM, but you're not merging it as it's required being an array/repeated field. Here's an example of merging an IP in to the IP field.


mutate {

merge => {

"event.idm.read_only_udm.principal.ip" => "src_ip"

}

on_error => "src_ip_empty"

}

Hi I have used the merge option still i am getting the same error 

RAW LOG :
756 <44>1 2020-05-19T20:34:47.862000Z sysloghost CylancePROTECT - - - Event Type: Threat, Event Name: threat_found, Device Name: ACME3CD33, IP Address: (1.2.3.4, 2.3.4.5), File Name: wpcao.dll, Path: C:\\\\Windows\\\\SysWOW64\\\\, Drive Type: Internal Hard Drive, SHA256: 3E0F9BABA07F02B0FE51E6FE5D34A5E0D4EE589A661A94EFD615025B92FB2DD4, MD5: 931F6FC6390D20912B1BA39CC2C307F3, Status: Unsafe, CylanceScore: 100, Found Date: 5/19/2020 3:34:48 PM, File Type: Executable, Is Running:False, Auto Run: False, Detected By: BackgroundThreatDetection, Zone Names:(Office: AMITA,OS: Windows Workstations), Is Malware: False, Is Unique To Cylance: False, Threat Classification: Trusted - Local, Device Id: 9cb1b895-e816-441a-b403-d17bfaf0bca9, Policy Name: 1-AQT



PARSER
filter {

mutate {
replace => {
"event.idm.read_only_udm.metadata.vendor_name" => "Cylance"
"event.idm.read_only_udm.metadata.product_name" => "Protect"
"event.idm.read_only_udm.metadata.event_type" => "SCAN_HOST"
"ipAddress" => ""
"is_alert" => "true"
"WHEN" => ""
"cylancehost" => ""
}
}
# extract the syslog header(timestamp and device hostname) and the data(which is in kv format)
grok {
match => {
"message" => [
"\\\\d+ (<\\\\d+>)\\\\d %{TIMESTAMP_ISO8601:WHEN} %{IPORHOST:cylancehost} Cylance(PROTECT|OPTICS) - - - %{GREEDYDATA:kvdata}"
]
}
overwrite => ["WHEN","cylancehost"]
on_error => "grok_message_fail"
}

# Save the value in "when" to the event timestamp
mutate {
rename => {
"WHEN" => "timestamp"
}
}


kv {
source => "kvdata"
value_split => ":"
field_split => ","
}


mutate {
rename => {
"IP Address" => "IP_Address"
"Event Name" => "Action"
"Device Name" => "Device_Name"
"File Name" => "File_Name"
}
}

if [IP_Address] != "()" {
grok {
match => {
"kvdata" => [ "IP Address: \\\\((%{IP:ipAddress})?(, %{IP:ipAddress2})?(, %{IP:ipAddress3})?(, %{IP:ipAddress4})?.*\\\\)" ]
}
on_error => "grok_kv_fail"
overwrite => ["ipAddress","ipAddress2","ipAddress3","ipAddress4"]
}
}

mutate {
replace => {
"security_result.severity_details" => "%{CylanceScore}"
"event.idm.read_only_udm.metadata.product_event_type" => "%{Event Type}"
"event.idm.read_only_udm.target.hostname" => "%{Device_Name}"
"event.idm.read_only_udm.target.process.file.sha256" => "%{SHA256}"
}
}


if [Path] != "" {
mutate {
replace => {
"event.idm.read_only_udm.target.process.file.full_path" => "%{Path}%{File_Name}"
}
}
}

if [ipAddress] != "" {
mutate {
merge => {
"event.idm.read_only_udm.target.ip" => "ipAddress"
}
}
}

if [ipAddress2] != "" {
mutate {
merge => {
"event.idm.read_only_udm.target.ip[1]" => "ipAddress2"
}
}
}


if [Action] == "threat_found"
{
mutate {
replace => {
"Action" => "ALLOW"
}
}
}
else if ([Action] == "threat_quarantined") {
mutate {
replace => {
"Action" => "QUARANTINE"
}
}
}
else {
mutate {
replace => {
"Action" => "UNKNOWN_ACTION" }
}
}

# save transformed value to an intermediary field
mutate {
merge => {
"security_result.action" => "Action"
}
}

# save the security_result field
mutate {
merge => {
"event.idm.read_only_udm.security_result" => "security_result"
}
}

mutate {
merge => {
"@output" => "event"
}
}
}

For the 2nd IP address, there is no need to provide an array index to merge into. You just need to merge it into target.ip and it will append it to the array. The below should fix that error.


 


if [ipAddress2] != "" {
mutate {
merge => {
"event.idm.read_only_udm.target.ip" => "ipAddress2"
}
}
}

 

For the 2nd IP address, there is no need to provide an array index to merge into. You just need to merge it into target.ip and it will append it to the array. The below should fix that error.


 


if [ipAddress2] != "" {
mutate {
merge => {
"event.idm.read_only_udm.target.ip" => "ipAddress2"
}
}
}

 


Hey Mikewilisz, 

Thanks for the response. However since both will appear under target. Ip. If one of the IP is suspicious, how can we use it an alert? 

Reply


Terms & ConditionsCookie settings
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.